For testing and debugging purposes, you also have fine-grained control on how
the watch runs. You can execute the watch without executing all of its actions
or alternatively by simulating them. You can also force execution by ignoring
the watch condition and control whether a watch record would be written to the
watch history after execution.

You can use the Execute API to execute watches that are not yet registered by
specifying the watch definition inline. This serves as great tool for testing
and debugging your watches prior to adding them to Watcher.

This structure is parsed as the data of the trigger event
that will be used during the watch execution

ignore_condition

no

false

When set to true, the watch execution uses the
Always Condition.
This can also be specified as a HTTP parameter.

alternative_input

no

null

When present, the watch uses this object as a payload
instead of executing its own input.

action_modes

no

null

Determines how to handle the watch actions as part of the
watch execution. See Action Execution Modes
for more information.

record_execution

no

false

When set to true, the watch record representing the watch
execution result is persisted to the .watcher-history
index for the current time. In addition, the status of the
watch is updated, possibly throttling subsequent executions.
This can also be specified as a HTTP parameter.

watch

no

null

When present, this
watch is used
instead of the one specified in the request. This watch is
not persisted to the index and record_execution cannot be set.

Action modes define how actions are handled during the watch execution. There
are five possible modes an action can be associated with:

Name

Description

simulate

The action execution is simulated. Each action type
define its own simulation operation mode. For example, the
email action creates
the email that would have been sent but does not actually
send it. In this mode, the action might be throttled if the
current state of the watch indicates it should be.

force_simulate

Similar to the the simulate mode, except the action is
not be throttled even if the current state of the watch
indicates it should be.

execute

Executes the action as it would have been executed if the
watch would have been triggered by its own trigger. The
execution might be throttled if the current state of the
watch indicates it should be.

force_execute

Similar to the execute mode, except the action is not
throttled even if the current state of the watch indicates
it should be.

skip

The action is skipped and is not executed or simulated.
Effectively forces the action to be throttled.

When X-Pack security is enabled on your Elasticsearch cluster, then watches will be
executed with the privileges of the user that stored the watches. If your user
is allowed to read index a, but not index b, then the exact same set of
rules will apply during execution of a watch.

When using the execute watch API, the authorization data of the user that
called the API will be used as a base, instead of of the information who stored
the watch.